OmniAuth SAML RM Unify

An RM Unify SAML strategy for OmniAuth.

https://github.com/hampei/omniauth-saml-rmunify

It's a simple subclass of omniauth-saml with a rm unify specific info hash.
Take a look at rm attributes for descriptions.
The attribute names have been taken from the manage-app/single-sign-on/saml-p page, underscored for your convenience.
Read the list of info attributes for what is available.

Requirements

omniauth-saml '~> 1.1.0'

Usage

See omniauth-saml for more options.

In your Rails application:

in Gemfile:

gem 'omniauth-saml-rmunify'

and in config/initializers/omniauth.rb:

RM_UNIFY_SETTINGS = {
  base_url:                       "https://sts.platform.rmunify.com",
  assertion_consumer_service_url: "https://#{app_host}/users/auth/saml_rmunify/callback",
  issuer:                         "https://#{app_host}/rmunify",
  idp_sso_target_url:             "https://sts.platform.rmunify.com/issue/saml/?binding=redirect",
  idp_cert_fingerprint:           "66:cb:2d:02:cd:81:f1:b1:03:22:6b:a0:21:cd:8e:69:0c:5e:f4:25",
  idp_slo_target_url:             'https://sts.platform.rmunify.com/issue/samlSLO/?binding=redirect'
}
Rails.application.config.middleware.use OmniAuth::Builder do
  provider :saml_rmunify, RM_UNIFY_SETTINGS
end

In your callback:

  def saml_rmunify
    uid = request.env["omniauth.auth"].uid
    info = request.env["omniauth.auth"].info
    info.licence # {"is_trial"=>false, "is_connector"=>false, "description"=>".../premium/Pri/1y/RMUnify",
                 #  "app_name"=>"...", "package_name"=>"premium", "school_type"=>"Pri", "term"=>"1y"}
  end

Authors

Authored by Henk van der Veen.

Maintained by Henk van der Veen.

License

Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:

The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

Question on logout

Hi,

I tried to implement a proper log-out for RM Unify using your explanation (https://github.com/hampei/omniauth-saml-rmunify/wiki/single_logout) and couple of other guides that your work derives from:
https://github.com/onelogin/ruby-saml#single-log-out
https://gist.github.com/mcansky/e165aecf64d5c39e71cb

But non of them seems to be working ATM.

My log-out controller which called by IdP in case when RM Unify user log-outs from their dashboard looks like this:

class RmunifyLogoutController < ApplicationController

  require 'ruby-saml'

  def index

    logout_request = OneLogin::RubySaml::SloLogoutrequest.new(params[:SAMLRequest])
    Rails.logger.debug ">> IdP logout_request: #{logout_request}"
    if !logout_request.is_valid?
      Rails.logger.error ">> IdP initiated LogoutRequest was not valid!"
      render plain: logout_request.errors, status: 400
    end

    uid = logout_request.name_id
    Rails.logger.debug ">> IdP initiated LogoutRequest, name_id: #{uid}"
    Rails.logger.debug ">> IdP initiated LogoutRequest, id: #{logout_request.id}"

    # Re-Enable when request will work
    # if session["rm_unify_record"].present?
    #   reset_session
    #   cookies.delete(:remember_me) 
    # end

    Rails.logger.debug ">> IdP RM_UNIFY_SETTINGS: #{rmunify_settings}"
    settings = OneLogin::RubySaml::Settings.new(rmunify_settings)
    Rails.logger.debug ">> IdP settings: #{settings}"
    Rails.logger.debug ">> IdP params[:RelayState]: #{params[:RelayState]}"
    #logout_response = OneLogin::RubySaml::SloLogoutresponse.new.create(settings, logout_request.id, nil, :RelayState => params[:RelayState])
    logout_response = OneLogin::RubySaml::SloLogoutresponse.new.create(settings, logout_request.id, nil, :RelayState => params[:RelayState])
    Rails.logger.debug ">> IdP logout_response: #{logout_response}"
    redirect_to logout_response
  end

  def rmunify_settings
    settings = {
      assertion_consumer_service_url: "http://domain:3000/auth/saml_rmunify/callback",
      issuer:                         "https://domain/#{Rails.env}",
      idp_sso_target_url:             "http://sts.platform.rmunify.com/issue/saml/?binding=redirect",
      idp_cert_fingerprint:           "66:cb:2d:..."
    }
    settings
  end
end

All works, until it comes to line 31 where I get Internal Server Error 500, with following print:

# current_user: 3335 / RMUnifyA
  School Load (0.1ms)  SELECT `schools`.* FROM `schools` WHERE `schools`.`id` = 1236 LIMIT 1
>> IdP logout_request: #<OneLogin::RubySaml::SloLogoutrequest:0x00000009537b00>
>> IdP initiated LogoutRequest, name_id: <correct name id>
>> IdP initiated LogoutRequest, id: <correct id>
>> IdP RM_UNIFY_SETTINGS: {:assertion_consumer_service_url=>"<correct settings>", :issuer=>"<correct settings>", :idp_sso_target_url=>"http://sts.platform.rmunify.com/issue/saml/?binding=redirect", :idp_cert_fingerprint=>"66:cb:..."}
>> IdP settings: #<OneLogin::RubySaml::Settings:0x00000009504570>
>> IdP params[:RelayState]: /issue/samlSLO?binding=redirect
Created SLO Logout Response: <samlp:LogoutResponse ID='_b93e1380-XXXX....' InResponseTo='_796a471c-XXX...' IssueInstant='2014-12-XXX...' Version='2.0' xmlns:saml='urn:oasis:names:tc:SAML:2.0:assertion' xmlns:samlp='urn:oasis:names:tc:SAML:2.0:protocol'><samlp:Status><samlp:StatusCode Value='urn:oasis:names:tc:SAML:2.0:status:Success'/><samlp:StatusMessage>Successfully Signed Out</samlp:StatusMessage></samlp:Status><saml:Issuer>https://app.petrasplanetforschools.com/development</saml:Issuer></samlp:LogoutResponse>
Completed 500 Internal Server Error in 13.8ms

NoMethodError (undefined method `+' for nil:NilClass):
  app/controllers/rmunify_logout_controller.rb:31:in `index'

Line 31 in my code, looks like this:
logout_response = OneLogin::RubySaml::SloLogoutresponse.new.create(settings, logout_request.id, nil, :RelayState => params[:RelayState])

It seems that SLOLogoutrequest created correctly, at least I can see it's print in server log, but then for some mysterious reason I'm getting Server Error 500 instead of redirecting to log-out request that was created

Any help from your side is highly appreciated.

P.S. I'm not using Devise in this implementation, so I was experimenting first to get proper settings setup for log-out request. Now settings looks ok, or at least in log-out request print I can see the correct values, which indicates that the settings were parsed correctly.

Thank you in advance.

hampei / omniauth-saml-rmunify Goto Github PK